Sophos UTM 9.705-3 Intrusion Prevention

Hello Richard,

Thank you for contacting the Sophos Community!

Please check out this KB and this KB on IPS tunning and some settings you can modify.

Regards,

Hi Richard,

What tool are you using to measure speeds?

What results do you get when you can try the following at the command line of the UTM?  Copy and paste as one block:

cd /home
wget raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py --no-check-certificate
cc set ips status 0
sleep 15s
python speedtest.py
cc set ips status 1
sleep 30s
python speedtest.py

Cheers - Bob

Hi Bob,

I was using speedtest.net from a web browser for both tests, with and without Intrusion Prevention enabled.

I've just ran that test there with Intrusion Prevention enabled:

Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by UltraNetworks (Aberdeen) [201.67 km]: 38.947 ms
Testing download speed................................................................................
Download: 64.44 Mbit/s
Testing upload speed................................................................................................
Upload: 19.92 Mbit/s

Without Intrusion Prevention enabled:

Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Sure Telecom (Douglas) [195.42 km]: 34.97 ms
Testing download speed................................................................................
Download: 98.78 Mbit/s
Testing upload speed................................................................................................
Upload: 20.19 Mbit/s


The server seems to change when switching Intrusion Prevention on/off. If I try doing speedtest.net from a web browser and select a server nearer to me, I get 212Mbps download (with Intrusion Prevention disabled). With it enabled... I got 99Mbps.

Cheers,
Richard

Hi Emmanuel,

I have looked at both KB articles, but unfortunately the problem is still occuring. The odd thing is that if I enable Intrusion Prevention but disable everything within... the problem still occurs?

Regards,
Richard

RichardHughes1 said:

Download: 98.78 Mbit/s

That makes me wonder if there isn't another issue causing your speed measurements to vary  What if you start the following at 6PM to test once every hour for 12 hours?

for i in {1..11}; do python speedtest.py|grep Mbit; sleep 1h; done; python speedtest.py|grep Mbit

Cheers - Bob

Hi Bob,

Just set this up now so I'll let you know the results. I'm not sure exactly what is wrong here as it only happens when I enable Intrusion Prevention. Even if I disable every setting within Intrusion Prevention, but still have Intrusion Prevention enabled... I still get the limited Download speeds.

Cheers,
Richard

Download: 106.59 Mbit/s
Upload: 17.73 Mbit/s
Download: 94.82 Mbit/s
Upload: 20.20 Mbit/s
Download: 90.58 Mbit/s
Upload: 19.71 Mbit/s
Download: 67.39 Mbit/s
Upload: 19.85 Mbit/s
Download: 84.04 Mbit/s
Upload: 19.80 Mbit/s
Download: 104.32 Mbit/s
Upload: 14.04 Mbit/s
Download: 90.97 Mbit/s
Upload: 20.42 Mbit/s
Download: 115.38 Mbit/s
Upload: 20.07 Mbit/s
Download: 103.59 Mbit/s
Upload: 20.30 Mbit/s
Download: 97.71 Mbit/s
Upload: 20.69 Mbit/s
Download: 106.73 Mbit/s
Upload: 20.36 Mbit/s
Download: 103.26 Mbit/s
Upload: 20.28 Mbit/s

I've always assumed that the snort single instance was the crux of the speed test always capping at <=100Mbps problem.

I upgraded to 9.705-3 this morning and decided to search to see if I could find problems anyone else was reporting so I could be aware in case I experienced similar issues, and saw this thread.

In the past I've found some things Bob has mentioned about settings that helped tune IPS but I never got over 100Mb (like 105 would be the highest burst I would see)

Today I decided to spend some time playing with settings and I found an odd anomaly.
****disclaimer I'm not an expert at Sophos UTM, I've been using since Astaro 'in 2007ish I think', but follow the recommendations of support, and then defer to Bob, be ready to assume your own risks****

Prior to 9.705-3, I had already set my num_instances to 7 for my 8 cpu VM: (default = 0 which is supposed to be n-1)

Prior to 9.705-3, I had already adjusted my queue_length:

Today I decided to play with max_queued_bytes and immediately saw the speed increase:

The anomaly was when I changed my max_queued_bytes back to 0 I'm still getting 220+Mbps. I've rebooted the UTM to be sure it wasn't a fluke, and I'm seeing similar S5 logs for max bytes:

EDIT: 2020-10-06 Instead of using the link I provide here, use the one below found by Amodin and davery23.

Excellent find, Dave!  I think the best thread here for such optimizations is Sascha Paris' old ASG Tweaking thread.

Cheers - Bob

Bob, I wen to that ASG tweak link and page isn't found.  ;)  

I'd like to start tweaking mine, as my UTM seems to be having the same thing on this release, and I've SSH'd into my UTM maybe twice ever.

I found this one, but wasn't sure if that was the same one you were trying to link.